Map client contact details, appointment records, photos, employee records and payment-related information. Identify where each is stored, why it is needed, who can access it and how long it should be retained under relevant requirements. Do not collect sensitive details simply because a form allows them. Use fictional data for practice and never paste actual client records into these course worksheets.

Use individual accounts, strong unique passwords, a reputable password manager and multifactor authentication where available. Review permissions when roles change and remove unneeded access promptly. Shared administrator accounts make responsibility and revocation harder. Keep recovery options secure and documented for authorized people; do not disable controls because login is inconvenient.

A message can copy a familiar name and still be fraudulent. Treat unexpected password resets, payment changes, urgent data requests and attachments cautiously. Verify using a previously known contact route, not the number or link supplied in the suspicious message. Never share verification codes merely because a caller claims to be support. Report the attempt through the business process.

Keep software supported and updated, secure devices and plan recoverable backups appropriate to the business. A backup that has never been restored is an untested assumption. Restrict backup access and test recovery with non-sensitive practice data. Vendor features and responsibilities vary; review settings, retention and support rather than assuming a cloud subscription guarantees recovery or compliance.

Use a written contact and escalation plan. Stop the suspected exposure using appropriate technical help, preserve relevant evidence and document what is known versus uncertain. Do not promise that no data was affected before checking. Legal notification duties, timing and contractual requirements vary; obtain qualified advice promptly. Communicate accurate facts through an authorized person rather than improvising public assurances.